Shell Injection Data Exfiltration — Piped Command Exfiltration via Bash - ATR-2026-00863 (79db7487-9bd9-50b5-9b5b-12fc44db5e98)
Detects shell command injection payloads that combine a seemingly legitimate shell operation with a piped or chained data exfiltration command. The attack embeds a benign-sounding task (ping, git status, grep for audit) with a follow-on command that reads sensitive files (.env, credentials, passwords) and POSTs or transmits the data to an attacker-controlled endpoint via curl, wget, nc, or Python urllib. Derived from the exfil-shell-injection corpus. This extends rule ATR-2026-00201 (credential pipe exfiltration) to cover shell script compound command patterns beyond environment variable pipes.